CVE-2025-68724

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.

Red Hat has rated this vulnerability as Moderate severity because exploitation requires local access and the ability to load a malformed X.509 certificate through kernel keyring interfaces. On typical Red Hat Enterprise Linux deployments, asymmetric key parsing is primarily utilized during system boot, module loading, or administrative cryptographic operations. A local attacker with appropriate privileges could supply a crafted certificate to cause memory corruption, potentially triggering a kernel crash or unauthorized memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.